How to Configure Sudo for Windows and Command Elevation in Windows 11

For decades, Windows system administrators and software developers working in PowerShell or Command Prompt faced a persistent productivity hurdle: when a command required administrative privileges, Windows lacked an inline mechanism to elevate execution on the fly. Users were forced to right-click terminal icons, select “Run as administrator” to launch a completely separate elevated console, navigate back to their working directory, and retype the command. In Windows 11 (build 26052 and later), Microsoft introduced native Sudo for Windows. This open-source utility allows users to run elevated administrative commands directly from standard un-elevated terminal sessions.

Security Architecture and UAC Integration

Unlike Linux sudo which switches user accounts via setuid, Sudo for Windows integrates natively with the Windows User Account Control (UAC) security boundary:

• UAC Enforcement: Invoking sudo prompts the standard Windows UAC elevation dialog, verifying cryptographic execution permissions before running elevated code.
• RPC Process Decoupling: When configured in inline modes, the un-elevated console communicates with the elevated background process over secured inter-process Remote Procedure Calls (RPC), preventing un-elevated parent shells from tampering with elevated memory.

Enabling Sudo for Windows in System Settings

By default, Sudo for Windows is disabled for system safety. To enable it:

1. Open the Settings app on Windows 11.
2. In the left sidebar, click System.
3. Scroll down and select For developers.
4. Locate the Enable sudo toggle switch and switch it to On.
5. A confirmation prompt appears; click Yes to enable the subsystem.

Choosing the Appropriate Elevation Mode

Directly beneath the Enable toggle, click the dropdown to choose how sudo runs commands:

• In a new window (Most Secure / Default): Launches an elevated process in a separate standalone terminal window that closes automatically when finished. Recommended for sensitive enterprise workstations.
• With input disabled: Runs the command inside your current terminal window and streams standard output (stdout) back into your console, but disables standard input (stdin), preventing malicious parent processes from injecting keystrokes into elevated prompts.
• Inline (Most Convenient): Behaves identically to Linux sudo. Both input and output remain connected inside your current active terminal session.

Configuring Sudo Modes via PowerShell Command Line

To configure operational modes programmatically across automated setups:

# Enable Sudo with Inline execution mode
sudo config --enable inline

# Switch to New Window mode
sudo config --enable forceNewWindow

# Switch to Input-Disabled mode
sudo config --enable disableInput

Executing Administrative Commands with Sudo

Once enabled, preface any privileged utility with sudo inside standard Windows Terminal, PowerShell, or cmd sessions:

# Restart system services directly from a standard shell
sudo net stop wuauserv

# Edit system hosts file with administrative rights
sudo notepad C:\Windows\System32\drivers\etc\hosts

# Inspect active driver services
sudo sc query type= driver

Sudo for Windows eliminates repetitive window switching while maintaining the fundamental Windows UAC security model.